Maintenance #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Maintenance | |
| on: | |
| schedule: | |
| # Run weekly on Sundays at 2 AM UTC | |
| - cron: '0 2 * * 0' | |
| workflow_dispatch: | |
| jobs: | |
| dependency-update: | |
| name: Update Dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22.x' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Update dependencies | |
| run: | | |
| npm update | |
| npm audit fix --audit-level=moderate || true | |
| - name: Run tests after update | |
| run: npm run test:ci | |
| continue-on-error: true | |
| id: test_results | |
| - name: Create Pull Request | |
| uses: peter-evans/create-pull-request@v5 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: 'chore: update dependencies' | |
| title: 'chore: Weekly dependency updates' | |
| body: | | |
| ## Automated Dependency Updates | |
| This PR contains automated dependency updates performed by GitHub Actions. | |
| ### Changes | |
| - Updated npm dependencies to latest compatible versions | |
| - Applied security fixes where available | |
| ### Test Results | |
| - Tests passed: ${{ steps.test_results.outcome == 'success' }} | |
| Please review the changes and merge if everything looks good. | |
| branch: chore/dependency-updates | |
| delete-branch: true | |
| security-scan: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.x' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run security audit | |
| run: | | |
| echo "## Security Audit Results" >> $GITHUB_STEP_SUMMARY | |
| npm audit --json > audit-results.json || true | |
| # Parse audit results and add to summary | |
| if [ -s audit-results.json ]; then | |
| echo "### Vulnerabilities Found" >> $GITHUB_STEP_SUMMARY | |
| cat audit-results.json | jq -r '.vulnerabilities | to_entries[] | "- **\(.key)**: \(.value.severity) severity"' >> $GITHUB_STEP_SUMMARY || true | |
| else | |
| echo "No vulnerabilities found! ✅" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Upload audit results | |
| uses: actions/upload-artifact@v3 | |
| if: always() | |
| with: | |
| name: security-audit-results | |
| path: audit-results.json | |
| retention-days: 30 |